Security of "Counterfactual Quantum Cryptography' 
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Recently, a "counterfactual" quantum key distribution scheme was proposed by Tae-Gon Noh |1]. In this 
scheme, two legitimate distant peers may share secret keys even when the information carriers are not traveled 
in the quantum channel. We find that this protocol is equivalent to an entanglement distillation protocol (EDP). 
According to this equivalence, a strict security proof and the asymptotic key bit rate are both obtained when 
perfect single photon source is applied and Trojan-horse attack can be detected. We also find that the security 
of this scheme is deeply related with not only the bit error rate but also the yields of photons. And our security 
proof may shed light on security of other two-way protocols. 

PACS numbers: 03.67.Dd 



Quantum Key Distribution (QKD) yJ-Q] can enable two 
distant peers (Alice and Bob) to share secret random string 
of bits, called key. With QKD and one-time-pad, uncondi- 
tional secure communication is possible. The most commonly 
used QKD protocol is BB84, in which Alice encodes the state 
of a single photon, transmits it to Bob through a quantum 
channel which is accessed by a eavesdropper Eve, finally Bob 
projects this photon into some states. Not only the BB84 pro- 
tocol, nearly all of QKD protocols must transmit information 
carriers (usually, a single photon) in a public quantum chan- 
nel. Many successful experiments of QKD [5-11] have been 
achieved during the past decade. 

Quite interestingly, Tae-Gon Noh proposed a QKD proto- 
col (N09) [ 1], in which the distribution of a secret key bit can 
be accomplished even though a photon carrying secret infor- 
mation is not in fact transmitted through the quantum channel. 
Let us introduce the process of N09 protocol briefly. 

In N09 protocol, Alice randomly encodes single photon 
horizontal-polarized state \H) as bit or vertical-polarized 
state \V) as bit 1 and then inputs this photon to the port 2 
of a beam-splitter (BS), whose the reflection and transmis- 
sion modes are written as a and b respectively. For exam- 
ple, if Alice emits \H), the quantum state of this photon will 
be |iA„(V)> = (i\H(V)) a \0) b + \0) a \H(V)) b )/ V2, in which we 
consider a tt/2 phase is always added to reflection case and 
there's no phase change to transmission mode. The key point 
is that mode a is kept by Alice, while mode b represents the 
quantum channel between Alice and Bob. Thus, Eve can only 
access the mode b, while mode a is unaffected by Eve. Bob 
will choose to detect the \H) b by his single photon detector 
(SPD) D3 and just reflect other components of mode b as bit 
or detect the \V) b through Dj and just reflect other compo- 
nents of mode b as bit 1 . This operation can be viewed as a 
random projection to \X) b (X\, which will be detected by the 
detector D 3 and 1 - \X) b (X\, in which X = H or X = V. 
Bob's operation can be implemented by optical switches and 
polarization-beam-splitter (PBS). To detect the intrusion of 
Eve, Alice and Bob may compare the initial polarization state 
and the detected polarization state, if D3 clicks. 

The mode b reflected by Bob will return to the Alice's BS 
and at the same time the mode a will also arrive at this BS 



due to the reflection by a mirror owned by Alice. If the bit 
choices of Alice and Bob are different, then the photon will 
output from the port 2 of Alice's BS and then hit Alice's SPD 
£>2 due to the quantum interference. Conversely, if the bit 
choices are the same, Bob will get a click in D3 with proba- 
bility 1 /2, which means the photon was at mode b. But, with 
another probability of 1 /2, the photon is at mode a and thus 
Bob get no click in D^, Alice will get one click in D2 or D\ 
with equal chances. Therefore, a click from D; means the gen- 
eration of one bit secret key. The clicks of D\ can only step 
from the photon at mode a not the quantum channel mode b. 
Thus we say in N09 the task of distributing secret key bit can 
be finished when the information carriers are not traveled in 
quantum channel. 

The security of N09 has not been proved though there are 
some discussion on particular attacks. The security of this 
protocol cannot be followed by the claim that Eve cannot ac- 
cess the whole information carriers. Although some simple 
attacks such as Eve detects the polarization of mode b, will 
spoil the quantum interference and introduce bit error rate 
of key bits. Eve may entangle her ancilla with the informa- 
tion carrier and apply different operations to the go and return 
mode b. Eve is able to get some bit keys without introducing 
bit error. It's totally different with BB84 protocol, which Eve 
cannot launch an effective attack without introducing bit error 
in ideal case. Thus a strict security proof is in urgent need for 
N09 protocol. 

In this paper, we put forward a security proof of N09 proto- 
col when Trojan-horse-like attack 111211 is prohibited. We find 
that the security of N09 is highly related to not only the bit 
error rate of key, but also the counting rates of D\ and D^- 
Inspired by Ref ill 311 . we propose a entanglement distillation 
protocol (EDP) which is totally equivalent to the N09 proto- 
col. Here, the meaning of this equivalence between the two 
protocols is: to Alice and Bob, the generated secret key is 
the same; to Eve, the available information is also the same. 
The EDP is illustrated in Fig.l and the detailed steps are as 
follows: 

(1). Alice prepares N pairs of entanglement states J¥)a — 
(\H) A \ip H ) + \V)aWv))I V2, in which, the particle A and mode 
a is protected in Alice's security zone, while mode b is the 
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FIG. 1: A and if/ represent Alice's initial entangled particles; BS: 
beam-splitter; Filter: quantum operation controlled by Alice or Bob, 
which can project mode b into the Hilbert space spanned by |0), \H), 
and \V). And a failure of this filtering operation results in the abortion 
of the whole protocol; B 1 and B represent Bob's initial particles; PD: 
polarization detector which detects particles with projectors |0)(0|, 
|fl><flI.and|V><n 



quantum channel between Alice and Bob. Bob also prepares 
N pairs of states |¥> B = (\H) B + \V) B )\0)m/ V2, in which, 
the particles B and Bl are all ancilla owned by Bob, and Eve 
has no chance to access them. Alice sends all of the modes b 
of the N pairs of entanglement states and announces this fact 
publicly. 

(2). After passing through the quantum channel controlled 
by Eve, the mode b of nth \W) A will enter Bob's security 
zone. Bob will first project the mode b with projectors 
10X01 + \H)(H\ + \V)(V\, and / - |0><0| - \H){H\ - \V){V\. 
If Bob detects the mode b through the projective mea- 
surement / - |0 >< 0| - \H >< H\ - \V >< V\, he 
will abort the protocol. This operation is carried out 
by filter in Bob' security zone as in Fig.l. If not, Bob 
will apply an unitary transformation 6 i/Bob to this mode b 
and particle B and Bl of nth l^^. % G * is defined as: 
%ob\H) B \0)m\0) b = \H) B \0) B1 \0) b , W Bob \H) B \0) m \H)b = 
\H) B \H) m \0) b , ®r Bob \H) B \0) m \V) b = \H) B \0) m \V) b , 
W Bob \V) m \0) m \0) b = |V>fl|0> fl i|0> 6 , W Bob W)m\0) m \H) b = 
\V) B \0) m \H) b , W Bob \V) m \0) m \V) b = |y> B |y> B i|0>i. After this 
transformation, Bob will detect the particle Bl with projectors 
|0)<0|, \H){H\ and \V){V\ and record the result. After that, the 
mode b will re-enter the quantum channel. 

(3). After traveling along quantum channel controlled by 
Eve, the nth mode b will re-enter Alice's security zone. Be- 
fore Alice combines this mode a and mode b of nth \ x ¥)a 
in a BS at the same time, Alice must apply the same pro- 
jection as to Bob's projection in step (2) to detect any pos- 
sible Trojan-horse attack. This is done by filter in Alice's 
security zone as in Fig.l. Consider the normal attenua- 
tion of mode a is 77, the effective state of mode a after this 
BS is \H(V)) a — > y/fj(\H(V)h + i\H(V)) 2 ). For mode b, 
\H(V)) b — > (|iff(V)>i + \H(V)) 2 )I V2. 

(4). For each trial, Alice measures the mode 2 with the 
following projectors: |0) 22 <0|, \H) 22 {H\, and |V> 22 <V|. This 
operation corresponds to the PD in Fig.l. If a polarization 



state H or V of mode 2 is observed by Alice, she will mea- 
sure the polarization of corresponding particle A and the re- 
sult is recorded by her. If Alice gets |0>2 in her measurement, 
Alice will detect if the polarization of mode 1 and the corre- 
sponding particle A is the same. This operation can be done 
by unitary transformation defined by ^4|//(V))/i|0)i|ao) = 
|ff(V)> A |0>i|ao>, %l#(V)> A |#>t|ao> = \H(V)) A \H) 1 \a 1 (a 2 )), 
'W A \H{V)) A \V) l \ao) = |H(V)>a|V>i|02(ci)>, and \a ), \a x ) and 
\a 2 ) are all quantum states of Alice's ancilla and orthogonal 
with each other. Now Alice detects the a with projectors 
|ao)(ool> l fl i)( a il an d \a2}{a 2 y If the output of Alice's mea- 
surement on a is \a\), Alice will preserve the corresponding 
particle A, 1 for the following process. And these A and 1 are 
called polarization consistent particles (PCPs). If Alice obtains 
\a 2 ), she measures the polarization state of corresponding par- 
ticles 1 and A, which are called non-polarization-consistent 
particles (NPCPs) for abbreviation, and records the results. 

(5). After the transmission of N particles has completed, 
Bob tells Alice the results of detection of each Bl. Alice and 
Bob disregard all the particles corresponding to non-vacuum 
B 1 . Now, the following steps are only carried out for the cases 
that Bl is in vacuum. Alice asks Bob to measure the polariza- 
tion of particles B corresponding to NPCPs A. And then Alice 
and Bob randomly select half of the PCPs A, 1 and its cor- 
responding B, and measure them with the projectors \H){H\ 
and |V)(V|. Hence, the probabilities Pr(X A Y B B \Zo), in which 
X, Y, Z - H, V and D - 1, 2, are obtained by Alice and Bob. 

(6). According to all of the probabilities observed in step 
(5), Alice and Bob may carry out EDP for the other half of the 
PCPs A, 1 and its corresponding B. 

Since Eve cannot access Alice and Bob's ancillas, this vir- 
tual entanglement protocol is equivalent to N09 from Eve's 
view. To Alice and Bob, the key generated by the two pro- 
tocols is totally the same. Therefore, the security analysis of 
N09 protocol can be carried out on this EDP. On the other 
hand, the EDP can be reduced to N09 with Shor and Preskill's 
method ITlfTl. 

The initial state of Alice is given by: 



Windf = (4=IO>A,|0>i + l -\H) Aa \H) b + l -\V) Aa \V)„f 
V2 2 2 



(1) 



,in which, |0) Afl = {i\H) A \H) a + i\V) A \V) a )l V5, \H) Aa - 
\H) A \Q) a , and \V) Aa = |V>a|0> u . We also define |0> = (1,0, 0) r , 
\H) = (0, l,0) r , and \V) = (0,0, l) T . 

We must point out only mode b can be input into Alice and 
Bob, and the state of any modes b after Eve's operation must 
be in a Hilbert space spanned by |0), \H) and \V) since any 
state out of the Hilbert space may be detected by Bob and Al- 
ice's projection 1 - |0><0| - \H)(H\ - \V)(V\, which results in 
the abortion of the whole protocol. Above assumptions justify 
the negligence of Trojan attack, which makes the security of 
nearly all of "go and return" QKD protocols to be inexplicit. 
The most general attack is that: firstly, Eve may apply an uni- 
tary transformation % vc to all the N b modes and her ancilla 
e. Particularly, we consider the evolution of /th communica- 
tion. This step can be described mathematically like this: 
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7, r( o=ol7\ T(l) - 0) Aa W Eve \T, T(l) - 0) b \e^ d ^ assumption <% 

2 X |C^(0000)| 2 = 1. 



(2) 



Here, P{X} - |X)(X| and x in the summation notation 
must be 0, H, V. Note that the unitary of Eve's operation 



Eve^OoO 
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0, must result in 



e > = Z (C 

+ C ri r W=H |r, T(0 = H) Aa W Eve \T, T(l) - H) b \e ) Now, the effective operation done by Alice can be de- 

+ C T , m=v \T, T(l) = V) Aa W Eve \T, T(l) = V) h \e Q )) scribed like H(V) a -* ^Jfj{H{V)i+iH{V) 2 )l V2 and H(V) b -* 

(iH(V) x + H(V) 2 )/ V2. 

For simplicity, we define the a^ - Ca:(0000), p^ = 

iC K (H00H) + iC K (HVVH), y® = iC K (H00V) + iC K (HVVV), 
pf = iC K (V00V) + iC K (VHHV), yf = iC K (V00H) + 
iC K (VHHH), £® = iC K (H00H) + iC K (HHHH), £® = 
iC K (H00V) + iC K (HHHV), g® = iC K (V00V) + iC K (VVVV), 
and Ck = iC K (V00H) + iC K (VVVH). If Bob gets \0) m and 
Alice gets \a\) in step (4) of the EDP, the sub-system of A, B 
will be projected into: 



in which, T is a list like t\...t n ...t^, t„ - 0,H,V, and C is 
constant. Consider any state \T = ti....ti...ts)b\eo) must be 
transformed to a superposition which consists of three classes: 
ti = 0, ti = H or ti - V. In the next step Bob applies a i/Bob to 
the N b modes, B and B\. The result of Bob's operation can 
be re-written like this: 
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(3) 



Now, we can ana- 
'© 



, where A (,) is normalization Constance. 
V A 'J r vo( H B + V B*)°m°b 1 ' + Y vh(HI' H K g\Ql' + y®0®//f^yze the bit error rate and phase error rate of p'™ v Define 

\<P + ) ABl = (H A H B Hi + V A V B V X )I V2, \<p-) AB i = (H A H B H { - 
VaVbVO/^2, I<A + >abi = {H a VbH x + VaHbVx)!^, and 
|i/Oabi = (H a VbHi - V a HbV\)I V2, we can deduce bit error 
ratee® = Afil <i/' + |p^ 1 |i/r + > AB1 + A b\{^\p' A b 1 \^)ab\ and phase 
error rate e® = AB \ <0"Ip ab1 |0">abi +abi <^Ip a ® 1 |i/' _ >abi- 

With the expression of p^ B we can deduce the following 
probabilities for the Zth communication: 



, in which F represents the arbitrary state of all particles of 
n + I and Eve's ancilla. 

Thirdly, another unitary transformation a i/ Eve will be ap- 
plied to all the modes b and Y by Eve. We note that W Eve is 
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fc +^XYZHH' b 
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arbitrary, for example, ^' Eve T X Y^i - ^xyzo 
FxYzvV b , in which X,Y,Z - 0, //, V. For simplicity, we con- 
sider the Alice's detectors and Bob's detector never clicks 
twice in one communication. This condition can be justified in 
practical cases, due to the lower dark counts of SPD. Hence, 
we obtain r 0H - F v = and ^'ewTooO® = FooooO®. We 
also define \K), K = 0, 1,2... is a set of well-defined basis 
for all F states, and C K (ABCD) = (K\T ABCD ), A, B,C,D = 
0, H, V. According to above assumptions we may give the 
density matrix for the Zth particles A, B, SI, and modes a and 
b in the following equation: 



2P/' ) (// A y B B1 // 1 ) = ^ J] I ^ a K + ffl 



Pr®(H A V B m H 2 ) = — J] I V^4' 
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= 7 Z p {°A«[(^ + yB)OBiC JC (oooo)o i ] 

+ ^pH Afl YkH b + V B )0 m C K (H00x)x b 

V2 V 

+ H B H Bl C K (HH0x)x b + V B Bl C K (HHHx)x b 
+ H B Bl C K (HVVx)x b + V B V m C K (HV0x)x b ] 

+ ~^V Aa YjKHb + V B )0 B1 C K (V00x)x b 

+ H B H Bl C K (VH0x)x b + V B m C K (VHHx)x b 

+ H B o Bl c K (vvvx)x h + yByBiC x (yyox)x,]} 



Pr ([) (V A H B B iV 2 ) = — J] I V^7« W - ^°l 2 

AT 

2P/\H A H B o m H{) = iV| V^« W +ys w l 2 
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Pr {l \H A H B Q m H 2 ) = ^ Z ! ^4' -^l 2 

2Pr®(y A y B o B1 y!) = ^ Z ' ^ ffW +/ ? fl 2 

AT 
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Recall that 2a: I«a:I 2 = 
2Pr®(H A Hi$BiHi), and 
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Pr (l \H A H B Bl H 2 ), we obtain /3® = ZkIPk? = 
mPr {, \H A H B O m H x ) + Pr«\H A H B Q m H 2 )) - rj. By 

the same way, we obtain /3'® = Zxl/V I 2 = 
8(2 J Pr«(y A y B B1 V 1 ) + /^( Wfrggi Va)) - g. T hanks 
to Cauchy's inequality, ( VEd^ /d 2 - Vg^ l ^l 2 ) 2 < 

2* la* + z?d 2 < (VZ*W + VSa-i^i 2 ) 2 alwa y s 

holds for arbitrary complex numbers a* and /?*■ Due to 

La: If a- - f k I - Lie I V7 a A: + $k ~ V^k ~ $k I / 4 ' 
we obtain the upper bound of Yjk\£k ~ £'k I 2 I s 
£® = 8(V^«(// A y B B ii/i) + V^^O^BOmyO) 2 . 
With these parameters, <? ^ can be given by: 



, in which min{x,y) equals to the smaller one of x and y. 
Now the final problem is how to calculate the upper bound 
of e ph with constraints 8 = Efci/3®/iV,./6' = I^tiP'^ IN and 
£ = Zjli f (/, /^V. Note that min{x/( yfrj - yfxj 1 , 1} is a noncon- 
vex function about x (x — B <r \B' (r> ). And it's easy to verify 
that Zti min{£ (, >/4( yjrj - -^P) 2 , 1 } will be maximized when 
all the denominators are equal. Hence, we can obtain the fol- 
lowing upper bound of e P h '■ 



Ap + Aj? 

e p h < + 
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Though e® has been given, we cannot give the overall e p /, 

since e h may be arbitrary correlated with previous /- 1 events. 
Thanks to Azuma's inequality 11151 Hal , for sufficient large N 
pairs of A, B and 1, differs between e p h and Yli=i e pJ^ are 
arbitrary small. Therefore, we obtain the overall phase error 
rate e ph = £f =1 ef h /N. 

Also according to Azuma's inequality, we have B = 
I&ifiP/N = %{2PHH A H^ Bl H l )+PriH A H t fi Bl Hm-r l ,p = 
Zlr/3'V/N = %{2 P r (V A H B Q Bl V l ) + Pr {V A H B Q m V 1 ))- r 1 , and 
Ew £ (I) I N < 8 ( TfPr(H A VifiBiHi) + ^Pr(y A H B Bl V x )) 2 A f 
always hold when AT is sufficient large. Recall £a: la^l 2 = 1, 
we obtain 

+ iv^4 ) +a 2 + i^ ) +^ ,) i 2 ) (8) 

Therefore, the overall phase error rate can be bounded through 
the following inequality: 
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In fact, if there isn't Eve's attack, and no channel noises, 
Alice and Bob must find 2Pr(H A H B m Hi) - rj/16 and 
Pr(H A H B B iH 2 ) = J7/I6, thus B = 0. With the same way 
we obtain B' = 0, f = 0. Thus pure maximal entanglement 
states (H A H B Hi + V A V B Vi)/ yl can be shared between Alice 
and Bob. Due to the equivalence of the N09 and EDP, we con- 
clude that N09 is unconditional secure in the noiseless case. 
We must point out that the unconditional security is under the 
assumption that Eve cannot control the transmission efficiency 
of Alice's mode a and quantum efficiency of Alice and Bob's 
SPDs. This is different with BB84, which is secure even if the 
efficiency of detectors are controlled by Eve. 

We also consider a typical noise channel case, in which 
the visibility is V and polarization flip probability when pho- 
ton flying in quantum channel is p. Then we maybe ob- 
tain Pr(H A H B m Hi) = 77/32, Pr(H A H B Bl H 2 ) = i//16, 
Pr(H A V B 0mHi) = (\-V)(\-p)rill6,m<iPr(V A H B G B iVx) = 
(1 - V)(l - p)j]/ 16, from which we can deduce the eut - 
2(l-V)(l-p)/(l+2(l-V)(l-p))and<> = (l-V)(l-p)/2. 
For example, let V = 0.98, p — 0, we find eat - 3.85% while 
e p h = 1%. It's interesting that e p /, may be smaller than e^. 

In this paper, we have proved the unconditional security of 
N09 protocol by considering its equivalence to a EDP process. 
According to Ref. [17], our security proof is also composable. 
Through estimating the upper bound of the e p h, we obtain the 
key bit rate. We find the security of N09 protocol relies not 
only the bit error rate but also some counting rates of SPDs. 
We must point out that our security analysis is in an ideal sit- 
uation, in which we assume that perfect single photon source 
is applied, Alice and Bob can detect any type of Trojan-horse 
attacks, the mode a's evolution is perfect and the efficiencies 
of SPDs are all constant. We believe that our security analysis 
has given a solid foundation for real-life N09. The possible 
lower phase error rate than bit error rate may be an advantage 
of N09 protocol. 
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